Hard Drive Recovery Part 1

Back


Hard Drive Recovery presented at Toorcon by Scott Moulton of Forensic Strategy Services, LLC. Very detailed info on rebuilding hard drives and recovery of your own data.

Channel: Howto & Style
Uploaded: October 9, 2006 at 11:33 pm
Author: SuperFlyFlippingA

Length: 00:09:01
Rating: 4.55
Views: 134013

Tags: Hard Drive Data Recovery repair Toorcon Scott Moulton Forensic Forensics fix platters platter

Embed Code:


Video Comments:
PILMAN (October 18, 2008 at 6:00 pm)
I use EnCase and I have been unsuccessful in recovering a harddrive which used a similar program as evidence eliminator, it appears to have overwritten the data but it looks like it's using a binary checkerboard method with two passes of overwriting "DoD standard", then a third pass of pseudorandom garbage. I've attempted to recover the unallocated space but no go, is this data toast?
SuperFlyFlippingA (October 20, 2008 at 3:49 pm)
Yes the data is toast. However, there are usually some things left behind in the registry and other locations each time something is cleared. Also you can use Encase's ability to look at what is called MACE times and you will notice that the size of the clusters changed and notes a Date and Time. So while you cannot get the data back you can make a forensic case out of it showing the destruction of evidence.
PILMAN (October 20, 2008 at 3:56 pm)
True, but isn't there a method of manipulating the times/dates of when the data was erased or the regedits? What are MACE times? Also would destruction of data hold up in court if the individual did this before an investigation was ongoing?
PILMAN (October 20, 2008 at 4:00 pm)
The program used is called Terminus 6, it appears to wipe out the registry as well, when recovering files, it pulled volume information but the few files in unallocated space were strange file names like FInfinfFo.fo0, their large files that appear to be nothing but garbage ranging to about 500megs per file.
goforgold99 (October 17, 2008 at 7:40 am)
Hi. Thx for your great videos!

I have a QUESTION:

I've got a HDD which has this clicking noise when BIOS tries to recognize it.
Is there a chance that if I let BIOS try for a few hours, the HDD could somehow be recognized?
stiofan1 (October 9, 2008 at 6:18 am)
I recently sat my external drive down on a guitar amplifier. Since then it hasn't worked. It makes this clicking noise. I was wondering if it is more likely to be a hardware problem with the heads? or is a software recovery is still my first port of call. any help on this matter would be greatly appreciated!
buringkantong (September 30, 2008 at 12:23 am)
awesome
jrdzmex (September 23, 2008 at 9:29 pm)
hey spyware has deleted my computer HELP
SuperFlyFlippingA (September 10, 2008 at 5:46 pm)
Yes, you can save stuff as long as there is room. I would leave a few megs free just because something run over and will cause the application to crash.
saprissa9 (September 10, 2008 at 6:15 pm)
nice! yeah when im done with my projects i will move them into the big ass hard drive my school gave me haha. THANKS.